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Art Unit: 2672 

Claim Rejections - 35 USC §102 
The following is a quotation of the appropriate paragraphs of 35 U.S. C. 102 that form the 
basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public use or on 
sale in this country, more than one year prior to the date of application for patent in the United States. 

Claims 1-15 are rejected under 35 U.S.C. 102(b) as being anticipated by S. Ma, et al., 
"EventMiner: An integrated mining tool for Scalable Analysis of Event Data", May 21, 2001, 

www.researc'h. ibm.com . 
Claim 1: 

Ma teaches a method of monitoring events in a computer network, the method 
comprising: 

Said computer network triggering said events, each event being provided with attribute 
values allocated to a given set of attributes (See Page 1 , second paragraph, for attribute values, 
see the last paragraph of Page 6 and the first and second paragraphs of Page 8 and the real data 
set collected from a production computer network containing thousands of managed nodes 
including routers, hubs and servers are described in the last paragraph of page 3 and identifying 
unknown event patterns that can be used for real-time monitoring is described in the second 
paragraph of page 3); 

Providing an event display with a cross plot having x and y coordinate axes, the x-axis 
presenting a time period and the y-axis present an attribute value range (e.g., Figs. 2, 4, 6, 7 and 
the third paragraph of Page 8 describes a scatter plot or cross plot having an y-axis representing 
around 1 60 hosts of a communication network and the x axis has been described in the figures as 
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well as the first paragraph of page 6; for attribute value range, see these figures as well as the 
description in the second paragraph of Page 8); 

Determining a primary attribute of the events selected from the given set of attributes to 
be presented with its attribute values on the y-axis of the cross plot (e.g., attributes including the 
categorical attributes or temporal attributes such as the host names and the primary attribute 
values are displayed in Figs. 2, 4, 6 and 7 and multiple attributes are described in the last 
paragraph of Page 1 1), 

Allocating a first display label (e.g., Pattern 1, Pattern 2, Pattern 3 and Pattern 4 are 
marked in the scatter plot or the cross plot of Fig. 7) to the events (e.g., alarms in Page 10) 
indicating the attribute values of the primary attribute (key attribute values are described in the 
second paragraph of page 3 and other attribute values are also described there), providing a 
pattern algorithm (the pattern algorithm is described in Fig. 7 as well as the mining algorithm as 
described in the last paragraph of page 12 or the Event Miner) to detect whether an arrived event 
(arrived event are the selected event objects or the selected data objects in a specific time range 
related to the events progressively loaded from a database or the mining alarm logs in a real time 
system; see first paragraph of page 13 and the last paragraph of page 10 and a new query that 
retrieves the relevant data objects for more analysis in which a new query is restricted to a range 
constraint for a numerical attribute; see the last paragraph of page 10) is part of the given pattern 
(is part of the part of the given pattern such as the Pattern 1 or the Pattern 2) on the basis of a 
comparison of the attributes allocated to the given pattern and of the attributes assigned to the 
arrived event (coloring events by the coloring and filtering algorithm or the data mining 
algorithm and comparing the difference or similarity in terms of patterns indicated by colors; see 
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page 13), providing a mapping algorithm to map any attribute value of an attribute selected from 
the given set of attributes onto the y-axis of the cross plot (see the last paragraph of Page 1 1), 

Allocating a second display label (e.g., Pattern 2) to the events indicating the attribute 
values of the attributes being uncovered as part of the given pattern, plotting all the events 
arrived within the time period and including an attribute value allocated to the primary attribute 
into the cross plot with the first display label indicating the primary attribute, the position of the 
first display label of each event in the cross plot being determined on the basis of the attribute 
value of the primary attribute of the event and its arrival time (see Figs. 2, 4, 6, and 7 and the 
related paragraphs mentioned above in "allocating a first display label"), and 

Plotting the all events arrived within the time period (Figs. 2, 4, 6, and 7 plot the all 
events within a specific time range) and being detected by means of the pattern algorithm (by the 
event miner algorithm) as part of the given pattern into the cross plot with the second display 
label (e.g., Pattern 2 or the Green Spike in Fig. 10), the position of the second display label of 
each event in the cross plot being determined by the mapping algorithm on the basis of the 
attribute value of the attribute of the event (see Fig. 10) on the basis of the attribute value of the 
attribute of the event being uncovered (uncovered for example in the alarm log and uncovered by 
the mining algorithm) as part of the given pattern and its arrival time (all the selected events are 
in a specific time range as plotted in Figs. 2, 4, 6, 7 and 10). 

Re Claims 2-3: 

Ma further discloses selecting the new events within the specified time period and 
plotting the new events within the shifted time period into the cross plot (See Figs. 6, 7, 9 and 10 
in which events in the two time periods are drawn and the spikes are identified and the newly 
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selected events are redrawn as determined by the data mining algorithm for the time period 
during which the new events are retrieved). 
Re Claims 4-5: 

Ma further discloses the third display label and the fourth display label indicating the new 
patterns (See the three colored spikes in Fig. 6 and the four patterns in Fig. 7). 
Re Claim 6: 

Ma further discloses the operator selects the events to be plotted and displaying textual 
and coloring information associated with the selected events on the event display (Page 4 and 
Figs. 6, 7, 9-10). 

Re Claim 7: 

Ma further discloses a pattern algorithm such as the data mining algorithm suitable to 
perform mult i- attribute pattern recognition (Figs. 6, 7, 9-10). 
Re Claim 8: 

Ma further discloses using color such as Red and Green to color the pattern Spikes and 
Pattern 1, Pattern 2, Pattern 3, Pattern 4 for specific mark layouts (Figs. 6, 7, 9-10). 
Re Claim 9: 

Ma further discloses all events being uncovered as part of the pattern being clustered by 
the display label such as Red Spikes, Green Spikes (Figs. 6, 7 and 9-10). 
Re Claim 10: 

Ma further discloses a data mining algorithm and GUI (Page 14). 
Re Claim 1 1 : 

Ma further discloses the program code being stored on data carrier (see page 5). 
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Re Claim 12: 

Ma further discloses an event visualization device for monitoring events in a computer 
network (Page 3). 

Re Claims 13-15: 

Ma further discloses an implementation of the Event Miner algorithm on the computer 
(Page 4-5). 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jin-Cheng Wang whose telephone number is (571) 272-7665. 
The examiner can normally be reached on 8:00 - 6:30 (Mon-Thu). 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Mike Razavi can be reached on (571) 272-7664. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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